Gros problème de rootkits search d'Antivir !
Résolu
ant984
Messages postés
157
Statut
Membre
-
ant984 Messages postés 157 Statut Membre -
ant984 Messages postés 157 Statut Membre -
Bonjour,
voilà je suis un utilisateur d'antivir et le problème c'est que quand je fais un rootkit search il s'arrête toujours à environ 68%.
J'ai 3 screenshoots pour que vous puissez mieux comprendre ce qu'il se passe :
la recherche de rootkits se fait normalement, quand soudain il s'arrête sur une clé du système :
--> https://imageshack.com/
Ensuite antivir me demande ceci (P.S : la la clé n'est plus affichée mais c'est avcenter.exe, toujours vers 68%) :
---> https://www.hiboox.fr/
Comme je ne veux pas faire un scan mais juste un rootkit search, ben le scan passe directement de 68% a 100%: --> http://www.zimagez.com/zimage/rootkitssuspect3.php
Voilà merci de maider !! =) (P.S : Je pense que le screen le plus intéressant a analyser est le premier (avec la clé)
voilà je suis un utilisateur d'antivir et le problème c'est que quand je fais un rootkit search il s'arrête toujours à environ 68%.
J'ai 3 screenshoots pour que vous puissez mieux comprendre ce qu'il se passe :
la recherche de rootkits se fait normalement, quand soudain il s'arrête sur une clé du système :
--> https://imageshack.com/
Ensuite antivir me demande ceci (P.S : la la clé n'est plus affichée mais c'est avcenter.exe, toujours vers 68%) :
---> https://www.hiboox.fr/
Comme je ne veux pas faire un scan mais juste un rootkit search, ben le scan passe directement de 68% a 100%: --> http://www.zimagez.com/zimage/rootkitssuspect3.php
Voilà merci de maider !! =) (P.S : Je pense que le screen le plus intéressant a analyser est le premier (avec la clé)
A voir également:
- Gros problème de rootkits search d'Antivir !
- Spybot search and destroy - Télécharger - Antivirus & Antimalwares
- Search tool - Télécharger - Divers Web & Internet
- Www.google.com search video download - Télécharger - TV & Vidéo
- Search tool ip camera download - Télécharger - Web & Internet
- Bing visual search - Accueil - Intelligence artificielle
61 réponses
Voici le rapport :
############################## [ UsbFix V3.017 # Scan ]
# User : Antoine (Administrateurs) # ODI_ANTOINE
# Update on 06/05/09 by Chiquitine29, C_XX & Chimay8
# WebSite : http://pagesperso-orange.fr/NosTools/usbfix.html
# Start at: 00:40:52 | 08/05/2009
# AMD Athlon(tm) 64 Processor 3400+
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 7.0.5730.11
# Windows Firewall Status : Disabled
# AV : AntiVir Desktop 9.0.1.26 [ Enabled | Updated ]
# C:\ # Disque fixe local # 128 Go (93,97 Go free) [HP_PAVILION] # NTFS
# D:\ # Disque fixe local # 6,99 Go (1,83 Go free) [HP_RECOVERY] # FAT32
# E:\ # Disque CD-ROM
# F:\ # Disque CD-ROM
# G:\ # Disque amovible
# H:\ # Disque amovible
# I:\ # Disque amovible
# J:\ # Disque amovible
# K:\ # Disque amovible # 1,89 Go (1,34 Go free) # FAT
############################## [ Processus actifs ]
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\System32\alg.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Steam\Steam.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
c:\program files\steam\steamapps\ant984\condition zero\hl.exe
C:\Program Files\Steam\GameOverlayUI.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
################## [ Registre # Startup ]
HKCU_Main: "Local Page"="C:\\WINDOWS\\system32\\blank.htm"
HKCU_Main: "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
HKCU_Main: "Start Page"="https://www.google.fr/?gws_rd=ssl"
HKLM_logon: "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
HKLM_logon: "DefaultUserName"="Antoine"
HKLM_logon: "AltDefaultUserName"="Antoine"
HKLM_logon: "LegalNoticeCaption"=""
HKLM_logon: "LegalNoticeText"=""
HKLM_Run: NvCplDaemon=RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
HKLM_Run: StartCCC="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
HKLM_Run: nwiz=nwiz.exe /install
HKLM_Run: KBD=C:\HP\KBD\KBD.EXE
HKLM_Run: ftutil2=rundll32.exe ftutil2.dll,SetWriteCacheMode
HKLM_Run: AlwaysReady Power Message APP=ARPWRMSG.EXE
HKLM_Run: AlcxMonitor=ALCXMNTR.EXE
HKLM_Run: Adobe Reader Speed Launcher="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
HKLM_Run: avgnt="C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
HKLM_Run: NvMediaCenter=RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
HKLM_Run: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents=
HKCU_Run: ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe
################## [ Informations ]
################## [ Fichiers # Dossiers infectieux ]
################## [ Registre # Clés Run infectieuses ]
Found ! HKLM\software\microsoft\security center\\ "FirewallOverride"
# -> ( Value = 0x1 | Good = 0x0 Bad = 0x1 )
################## [ Registre # Mountpoints2 ]
HKCU\Software\Microsoft\....\MountPoints2\D\Shell\AutoRun\command
################## [ ! Fin du rapport # UsbFix V3.017 ! ]
############################## [ UsbFix V3.017 # Scan ]
# User : Antoine (Administrateurs) # ODI_ANTOINE
# Update on 06/05/09 by Chiquitine29, C_XX & Chimay8
# WebSite : http://pagesperso-orange.fr/NosTools/usbfix.html
# Start at: 00:40:52 | 08/05/2009
# AMD Athlon(tm) 64 Processor 3400+
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 7.0.5730.11
# Windows Firewall Status : Disabled
# AV : AntiVir Desktop 9.0.1.26 [ Enabled | Updated ]
# C:\ # Disque fixe local # 128 Go (93,97 Go free) [HP_PAVILION] # NTFS
# D:\ # Disque fixe local # 6,99 Go (1,83 Go free) [HP_RECOVERY] # FAT32
# E:\ # Disque CD-ROM
# F:\ # Disque CD-ROM
# G:\ # Disque amovible
# H:\ # Disque amovible
# I:\ # Disque amovible
# J:\ # Disque amovible
# K:\ # Disque amovible # 1,89 Go (1,34 Go free) # FAT
############################## [ Processus actifs ]
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\System32\alg.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Steam\Steam.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
c:\program files\steam\steamapps\ant984\condition zero\hl.exe
C:\Program Files\Steam\GameOverlayUI.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
################## [ Registre # Startup ]
HKCU_Main: "Local Page"="C:\\WINDOWS\\system32\\blank.htm"
HKCU_Main: "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
HKCU_Main: "Start Page"="https://www.google.fr/?gws_rd=ssl"
HKLM_logon: "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
HKLM_logon: "DefaultUserName"="Antoine"
HKLM_logon: "AltDefaultUserName"="Antoine"
HKLM_logon: "LegalNoticeCaption"=""
HKLM_logon: "LegalNoticeText"=""
HKLM_Run: NvCplDaemon=RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
HKLM_Run: StartCCC="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
HKLM_Run: nwiz=nwiz.exe /install
HKLM_Run: KBD=C:\HP\KBD\KBD.EXE
HKLM_Run: ftutil2=rundll32.exe ftutil2.dll,SetWriteCacheMode
HKLM_Run: AlwaysReady Power Message APP=ARPWRMSG.EXE
HKLM_Run: AlcxMonitor=ALCXMNTR.EXE
HKLM_Run: Adobe Reader Speed Launcher="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
HKLM_Run: avgnt="C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
HKLM_Run: NvMediaCenter=RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
HKLM_Run: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents=
HKCU_Run: ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe
################## [ Informations ]
################## [ Fichiers # Dossiers infectieux ]
################## [ Registre # Clés Run infectieuses ]
Found ! HKLM\software\microsoft\security center\\ "FirewallOverride"
# -> ( Value = 0x1 | Good = 0x0 Bad = 0x1 )
################## [ Registre # Mountpoints2 ]
HKCU\Software\Microsoft\....\MountPoints2\D\Shell\AutoRun\command
################## [ ! Fin du rapport # UsbFix V3.017 ! ]
Par contre vais bientôt me coucher suis fatigué on continuera les manips demain si tu es dispo bien sûr ;).
Merci d'avance.Bonne nuit
Merci d'avance.Bonne nuit
Pour la soit-disant clé infectée je pense que c'est un faux-positif, le pare-feu windows est désactivé par ma volonté, comme je suis derrière un routeur physique, un ami informaticien m'as dit que j'avais pas besoin de pare-feu.
Voilà sur ce bonne nuit !
Voilà sur ce bonne nuit !
Coucou,
le problème c'est que cet ami est occupé à aménager une nouvelle maison, je vais pas entrer dans les détails^^.
Mais si tu t'y connais en Anglais j'ai trouvé ce lien qui parle de la clé qui fait arrêter le rootkits search,le voici :
---> https://forum.sysinternals.com/?TID=12445
le problème c'est que cet ami est occupé à aménager une nouvelle maison, je vais pas entrer dans les détails^^.
Mais si tu t'y connais en Anglais j'ai trouvé ce lien qui parle de la clé qui fait arrêter le rootkits search,le voici :
---> https://forum.sysinternals.com/?TID=12445
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
il parle pas de solution ils tatonne sur le lien que ta poster
▶ Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d avoir été infectés sans les ouvrir
▶ Double clic sur le raccourci UsbFix présent sur ton bureau
▶ choisi l'option 2 ( Suppression )
▶ Ton bureau disparaîtra et le pc redémarrera .
▶ Au redémarrage , UsbFix scannera ton pc , laisse travailler l'outil.
▶ Ensuite post le rapport UsbFix.txt qui apparaîtra avec le bureau .
▶ Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque.( C:\UsbFix.txt )
( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )
▶ Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d avoir été infectés sans les ouvrir
▶ Double clic sur le raccourci UsbFix présent sur ton bureau
▶ choisi l'option 2 ( Suppression )
▶ Ton bureau disparaîtra et le pc redémarrera .
▶ Au redémarrage , UsbFix scannera ton pc , laisse travailler l'outil.
▶ Ensuite post le rapport UsbFix.txt qui apparaîtra avec le bureau .
▶ Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque.( C:\UsbFix.txt )
( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )
Re, voici le rapport :
############################## [ UsbFix V3.017 # Cleaning ]
# User : Antoine (Administrateurs) # ODI_ANTOINE
# Update on 06/05/09 by Chiquitine29, C_XX & Chimay8
# WebSite : http://pagesperso-orange.fr/NosTools/usbfix.html
# Start at: 18:12:28 | 08/05/2009
# AMD Athlon(tm) 64 Processor 3400+
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 7.0.5730.11
# Windows Firewall Status : Disabled
# AV : AntiVir Desktop 9.0.1.26 [ Enabled | Updated ]
# C:\ # Disque fixe local # 128 Go (93,92 Go free) [HP_PAVILION] # NTFS
# D:\ # Disque fixe local # 6,99 Go (1,83 Go free) [HP_RECOVERY] # FAT32
# E:\ # Disque CD-ROM
# F:\ # Disque CD-ROM
# G:\ # Disque amovible
# H:\ # Disque amovible
# I:\ # Disque amovible
# J:\ # Disque amovible
# K:\ # Disque amovible # 1,89 Go (1,34 Go free) # FAT
############################## [ Processus actifs ]
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
################## [ Fichiers # Dossiers infectieux ]
################## [ Registre # Clés Run infectieuses ]
# HKLM\software\microsoft\security center\\ "FirewallOverride"
# -> ( Value = 0x1 | Good = 0x0 Bad = 0x1 ) # -> Reset sucessfully !
################## [ Registre # Mountpoints2 ]
Deleted ! HKCU\Software\Microsoft\....\MountPoints2\D\Shell\AutoRun\command
################## [ Listing des fichiers présent ]
[02/01/2006 18:18|--a--c---|100] - C:\AUTOEXEC.BAT
[02/04/2006 15:22|-rahsc---|211] - C:\BOOT.BAK
[01/04/2009 21:36|-rahsc---|289] - C:\boot.ini
[10/08/2004 14:00|-rahsc---|4952] - C:\Bootfont.bin
[10/08/2004 14:00|-r-hs----|263488] - C:\cmldr
[07/05/2009 19:41|--a--c---|11800] - C:\ComboFix.txt
[10/10/2005 21:34|--a--c---|0] - C:\CONFIG.SYS
[07/05/2009 17:23|--a--c---|3629] - C:\fixnavi.txt
[?|?|?] - C:\hiberfil.sys
[08/10/2006 18:29|--a--c---|236] - C:\INSTALL.LOG
[10/10/2005 21:34|-rahsc---|0] - C:\IO.SYS
[10/10/2005 21:34|-rahsc---|0] - C:\MSDOS.SYS
[10/08/2004 14:00|-rahs----|47564] - C:\NTDETECT.COM
[04/09/2008 18:05|-rahs----|252240] - C:\ntldr
[?|?|?] - C:\pagefile.sys
[29/08/2007 23:29|--ah-c---|268] - C:\sqmdata00.sqm
[30/08/2007 17:38|--ah-c---|268] - C:\sqmdata01.sqm
[14/09/2007 23:52|--ah-c---|268] - C:\sqmdata02.sqm
[16/09/2007 22:43|--ah-c---|268] - C:\sqmdata03.sqm
[17/09/2007 21:58|--ah-c---|268] - C:\sqmdata04.sqm
[19/09/2007 15:29|--ah-c---|268] - C:\sqmdata05.sqm
[19/09/2007 16:37|--ah-c---|268] - C:\sqmdata06.sqm
[19/09/2007 20:44|--ah-c---|268] - C:\sqmdata07.sqm
[19/09/2007 21:43|--ah-c---|268] - C:\sqmdata08.sqm
[04/10/2007 22:00|--ah-c---|268] - C:\sqmdata09.sqm
[06/10/2007 19:56|--ah-c---|268] - C:\sqmdata10.sqm
[15/02/2009 21:55|--ah-c---|268] - C:\sqmdata11.sqm
[06/05/2007 12:09|--ah-c---|268] - C:\sqmdata12.sqm
[20/05/2007 22:01|--ah-c---|268] - C:\sqmdata13.sqm
[19/07/2007 23:26|--ah-c---|268] - C:\sqmdata14.sqm
[21/07/2007 01:08|--ah-c---|268] - C:\sqmdata15.sqm
[21/07/2007 14:22|--ah-c---|268] - C:\sqmdata16.sqm
[26/08/2007 23:45|--ah-c---|268] - C:\sqmdata17.sqm
[27/08/2007 19:46|--ah-c---|268] - C:\sqmdata18.sqm
[29/08/2007 00:31|--ah-c---|268] - C:\sqmdata19.sqm
[29/08/2007 23:29|--ah-c---|244] - C:\sqmnoopt00.sqm
[30/08/2007 17:38|--ah-c---|244] - C:\sqmnoopt01.sqm
[14/09/2007 23:52|--ah-c---|244] - C:\sqmnoopt02.sqm
[16/09/2007 22:43|--ah-c---|244] - C:\sqmnoopt03.sqm
[17/09/2007 21:58|--ah-c---|244] - C:\sqmnoopt04.sqm
[19/09/2007 15:29|--ah-c---|244] - C:\sqmnoopt05.sqm
[19/09/2007 16:37|--ah-c---|244] - C:\sqmnoopt06.sqm
[19/09/2007 20:44|--ah-c---|244] - C:\sqmnoopt07.sqm
[19/09/2007 21:43|--ah-c---|244] - C:\sqmnoopt08.sqm
[04/10/2007 22:00|--ah-c---|244] - C:\sqmnoopt09.sqm
[06/10/2007 19:56|--ah-c---|244] - C:\sqmnoopt10.sqm
[15/02/2009 21:55|--ah-c---|244] - C:\sqmnoopt11.sqm
[06/05/2007 12:09|--ah-c---|244] - C:\sqmnoopt12.sqm
[20/05/2007 22:01|--ah-c---|244] - C:\sqmnoopt13.sqm
[19/07/2007 23:26|--ah-c---|244] - C:\sqmnoopt14.sqm
[21/07/2007 01:08|--ah-c---|244] - C:\sqmnoopt15.sqm
[21/07/2007 14:22|--ah-c---|244] - C:\sqmnoopt16.sqm
[26/08/2007 23:45|--ah-c---|244] - C:\sqmnoopt17.sqm
[27/08/2007 19:46|--ah-c---|244] - C:\sqmnoopt18.sqm
[29/08/2007 00:31|--ah-c---|244] - C:\sqmnoopt19.sqm
[09/04/2007 16:50|--a--c---|20480] - C:\t2kg
[19/08/2007 18:31|--a--c---|20480] - C:\t2sg
[19/08/2007 18:53|--a--c---|16384] - C:\t314
[19/08/2007 12:00|--a--c---|24576] - C:\t39c
[19/08/2007 18:23|--a--c---|20480] - C:\t3hc
[09/04/2007 16:13|--a--c---|20480] - C:\t3uo
[09/11/2008 18:00|--a--c---|510] - C:\updatedatfix.log
[08/05/2009 18:13|--a--c---|5332] - C:\UsbFix.txt
[28/07/2001 07:07|---hs----|0] - D:\AUTOEXEC.BAT
[10/12/2004 20:31|---hs----|6] - D:\BLOCK.RIN
[09/01/2002 20:52|---hs----|244] - D:\BOOT.INI
[17/08/2001 10:26|---hs----|237728] - D:\CMLDR
[28/07/2001 07:07|---hs----|0] - D:\CONFIG.SYS
[10/09/2002 00:14|---hs----|100] - D:\Desktop.ini
[10/09/2002 17:21|---hs----|7850] - D:\Folder.htt
[30/04/2001 21:16|---hs----|14] - D:\Graph
[25/01/2002 19:21|---hs----|0] - D:\GRAPH16
[30/11/2004 12:01|---hs----|73728] - D:\Info.exe
[28/07/2001 07:07|---hs----|0] - D:\IO.SYS
[16/04/2006 19:31|---hs----|950] - D:\MASTER.LOG
[28/07/2001 07:07|---hs----|0] - D:\MSDOS.SYS
[25/07/2001 23:00|---hs----|45124] - D:\NTDETECT.COM
[17/08/2001 16:32|---hs----|0] - D:\NTFS
[25/07/2001 23:00|---hs----|222880] - D:\NTLDR
[10/09/2002 14:58|---hs----|181616] - D:\protect.ed
[10/12/2004 20:23|---hs----|36] - D:\SaveFile.Dir
[30/04/2001 21:16|---hs----|14] - D:\SVGA
[02/01/2006 10:16|--ahs----|906] - D:\USER
[08/02/2002 16:44|---hs----|88038] - D:\Warning.bmp
[18/08/2001 16:00|---hs----|10] - D:\WIN51
[22/01/2001 16:00|---hs----|11] - D:\WIN51.B2
[25/07/2001 16:00|---hs----|11] - D:\WIN51.RC1
[25/07/2001 21:47|---hs----|11] - D:\WIN51.RC2
[18/08/2001 16:00|---hs----|10] - D:\WIN51IC
[20/03/2001 16:00|---hs----|11] - D:\WIN51IC.B2
[25/07/2001 16:00|---hs----|11] - D:\WIN51IC.RC1
[25/07/2001 16:00|---hs----|11] - D:\WIN51IC.RC2
[17/08/2001 16:00|---hs----|10] - D:\WIN51IP
[22/01/2001 16:00|---hs----|11] - D:\WIN51IP.B2
[25/07/2001 21:47|---hs----|11] - D:\WIN51IP.RC2
[17/08/2001 14:17|---hs----|184] - D:\WINBOM.INI
[24/02/2004 17:38|--a------|498] - D:\BATCH.OLD
[01/02/2006 04:03|--ahs----|1552] - D:\BATCH.LOG
[02/01/2006 11:06|---hs----|208] - D:\cPCinfo.log
[16/04/2006 19:31|-r-hs----|26] - D:\RCBoot.sys
[17/07/2008 10:28|--a------|776256] - K:\ez5sys.bin
################## [ Vaccination ]
# C:\autorun.inf -> Folder created by UsbFix.
# D:\autorun.inf -> Folder created by UsbFix.
# K:\autorun.inf -> Folder created by UsbFix.
################## [ Cracks / Keygens / Serials ]
# -> Nothing found !
################## [ ! Fin du rapport # UsbFix V3.017 ! ]
############################## [ UsbFix V3.017 # Cleaning ]
# User : Antoine (Administrateurs) # ODI_ANTOINE
# Update on 06/05/09 by Chiquitine29, C_XX & Chimay8
# WebSite : http://pagesperso-orange.fr/NosTools/usbfix.html
# Start at: 18:12:28 | 08/05/2009
# AMD Athlon(tm) 64 Processor 3400+
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 7.0.5730.11
# Windows Firewall Status : Disabled
# AV : AntiVir Desktop 9.0.1.26 [ Enabled | Updated ]
# C:\ # Disque fixe local # 128 Go (93,92 Go free) [HP_PAVILION] # NTFS
# D:\ # Disque fixe local # 6,99 Go (1,83 Go free) [HP_RECOVERY] # FAT32
# E:\ # Disque CD-ROM
# F:\ # Disque CD-ROM
# G:\ # Disque amovible
# H:\ # Disque amovible
# I:\ # Disque amovible
# J:\ # Disque amovible
# K:\ # Disque amovible # 1,89 Go (1,34 Go free) # FAT
############################## [ Processus actifs ]
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
################## [ Fichiers # Dossiers infectieux ]
################## [ Registre # Clés Run infectieuses ]
# HKLM\software\microsoft\security center\\ "FirewallOverride"
# -> ( Value = 0x1 | Good = 0x0 Bad = 0x1 ) # -> Reset sucessfully !
################## [ Registre # Mountpoints2 ]
Deleted ! HKCU\Software\Microsoft\....\MountPoints2\D\Shell\AutoRun\command
################## [ Listing des fichiers présent ]
[02/01/2006 18:18|--a--c---|100] - C:\AUTOEXEC.BAT
[02/04/2006 15:22|-rahsc---|211] - C:\BOOT.BAK
[01/04/2009 21:36|-rahsc---|289] - C:\boot.ini
[10/08/2004 14:00|-rahsc---|4952] - C:\Bootfont.bin
[10/08/2004 14:00|-r-hs----|263488] - C:\cmldr
[07/05/2009 19:41|--a--c---|11800] - C:\ComboFix.txt
[10/10/2005 21:34|--a--c---|0] - C:\CONFIG.SYS
[07/05/2009 17:23|--a--c---|3629] - C:\fixnavi.txt
[?|?|?] - C:\hiberfil.sys
[08/10/2006 18:29|--a--c---|236] - C:\INSTALL.LOG
[10/10/2005 21:34|-rahsc---|0] - C:\IO.SYS
[10/10/2005 21:34|-rahsc---|0] - C:\MSDOS.SYS
[10/08/2004 14:00|-rahs----|47564] - C:\NTDETECT.COM
[04/09/2008 18:05|-rahs----|252240] - C:\ntldr
[?|?|?] - C:\pagefile.sys
[29/08/2007 23:29|--ah-c---|268] - C:\sqmdata00.sqm
[30/08/2007 17:38|--ah-c---|268] - C:\sqmdata01.sqm
[14/09/2007 23:52|--ah-c---|268] - C:\sqmdata02.sqm
[16/09/2007 22:43|--ah-c---|268] - C:\sqmdata03.sqm
[17/09/2007 21:58|--ah-c---|268] - C:\sqmdata04.sqm
[19/09/2007 15:29|--ah-c---|268] - C:\sqmdata05.sqm
[19/09/2007 16:37|--ah-c---|268] - C:\sqmdata06.sqm
[19/09/2007 20:44|--ah-c---|268] - C:\sqmdata07.sqm
[19/09/2007 21:43|--ah-c---|268] - C:\sqmdata08.sqm
[04/10/2007 22:00|--ah-c---|268] - C:\sqmdata09.sqm
[06/10/2007 19:56|--ah-c---|268] - C:\sqmdata10.sqm
[15/02/2009 21:55|--ah-c---|268] - C:\sqmdata11.sqm
[06/05/2007 12:09|--ah-c---|268] - C:\sqmdata12.sqm
[20/05/2007 22:01|--ah-c---|268] - C:\sqmdata13.sqm
[19/07/2007 23:26|--ah-c---|268] - C:\sqmdata14.sqm
[21/07/2007 01:08|--ah-c---|268] - C:\sqmdata15.sqm
[21/07/2007 14:22|--ah-c---|268] - C:\sqmdata16.sqm
[26/08/2007 23:45|--ah-c---|268] - C:\sqmdata17.sqm
[27/08/2007 19:46|--ah-c---|268] - C:\sqmdata18.sqm
[29/08/2007 00:31|--ah-c---|268] - C:\sqmdata19.sqm
[29/08/2007 23:29|--ah-c---|244] - C:\sqmnoopt00.sqm
[30/08/2007 17:38|--ah-c---|244] - C:\sqmnoopt01.sqm
[14/09/2007 23:52|--ah-c---|244] - C:\sqmnoopt02.sqm
[16/09/2007 22:43|--ah-c---|244] - C:\sqmnoopt03.sqm
[17/09/2007 21:58|--ah-c---|244] - C:\sqmnoopt04.sqm
[19/09/2007 15:29|--ah-c---|244] - C:\sqmnoopt05.sqm
[19/09/2007 16:37|--ah-c---|244] - C:\sqmnoopt06.sqm
[19/09/2007 20:44|--ah-c---|244] - C:\sqmnoopt07.sqm
[19/09/2007 21:43|--ah-c---|244] - C:\sqmnoopt08.sqm
[04/10/2007 22:00|--ah-c---|244] - C:\sqmnoopt09.sqm
[06/10/2007 19:56|--ah-c---|244] - C:\sqmnoopt10.sqm
[15/02/2009 21:55|--ah-c---|244] - C:\sqmnoopt11.sqm
[06/05/2007 12:09|--ah-c---|244] - C:\sqmnoopt12.sqm
[20/05/2007 22:01|--ah-c---|244] - C:\sqmnoopt13.sqm
[19/07/2007 23:26|--ah-c---|244] - C:\sqmnoopt14.sqm
[21/07/2007 01:08|--ah-c---|244] - C:\sqmnoopt15.sqm
[21/07/2007 14:22|--ah-c---|244] - C:\sqmnoopt16.sqm
[26/08/2007 23:45|--ah-c---|244] - C:\sqmnoopt17.sqm
[27/08/2007 19:46|--ah-c---|244] - C:\sqmnoopt18.sqm
[29/08/2007 00:31|--ah-c---|244] - C:\sqmnoopt19.sqm
[09/04/2007 16:50|--a--c---|20480] - C:\t2kg
[19/08/2007 18:31|--a--c---|20480] - C:\t2sg
[19/08/2007 18:53|--a--c---|16384] - C:\t314
[19/08/2007 12:00|--a--c---|24576] - C:\t39c
[19/08/2007 18:23|--a--c---|20480] - C:\t3hc
[09/04/2007 16:13|--a--c---|20480] - C:\t3uo
[09/11/2008 18:00|--a--c---|510] - C:\updatedatfix.log
[08/05/2009 18:13|--a--c---|5332] - C:\UsbFix.txt
[28/07/2001 07:07|---hs----|0] - D:\AUTOEXEC.BAT
[10/12/2004 20:31|---hs----|6] - D:\BLOCK.RIN
[09/01/2002 20:52|---hs----|244] - D:\BOOT.INI
[17/08/2001 10:26|---hs----|237728] - D:\CMLDR
[28/07/2001 07:07|---hs----|0] - D:\CONFIG.SYS
[10/09/2002 00:14|---hs----|100] - D:\Desktop.ini
[10/09/2002 17:21|---hs----|7850] - D:\Folder.htt
[30/04/2001 21:16|---hs----|14] - D:\Graph
[25/01/2002 19:21|---hs----|0] - D:\GRAPH16
[30/11/2004 12:01|---hs----|73728] - D:\Info.exe
[28/07/2001 07:07|---hs----|0] - D:\IO.SYS
[16/04/2006 19:31|---hs----|950] - D:\MASTER.LOG
[28/07/2001 07:07|---hs----|0] - D:\MSDOS.SYS
[25/07/2001 23:00|---hs----|45124] - D:\NTDETECT.COM
[17/08/2001 16:32|---hs----|0] - D:\NTFS
[25/07/2001 23:00|---hs----|222880] - D:\NTLDR
[10/09/2002 14:58|---hs----|181616] - D:\protect.ed
[10/12/2004 20:23|---hs----|36] - D:\SaveFile.Dir
[30/04/2001 21:16|---hs----|14] - D:\SVGA
[02/01/2006 10:16|--ahs----|906] - D:\USER
[08/02/2002 16:44|---hs----|88038] - D:\Warning.bmp
[18/08/2001 16:00|---hs----|10] - D:\WIN51
[22/01/2001 16:00|---hs----|11] - D:\WIN51.B2
[25/07/2001 16:00|---hs----|11] - D:\WIN51.RC1
[25/07/2001 21:47|---hs----|11] - D:\WIN51.RC2
[18/08/2001 16:00|---hs----|10] - D:\WIN51IC
[20/03/2001 16:00|---hs----|11] - D:\WIN51IC.B2
[25/07/2001 16:00|---hs----|11] - D:\WIN51IC.RC1
[25/07/2001 16:00|---hs----|11] - D:\WIN51IC.RC2
[17/08/2001 16:00|---hs----|10] - D:\WIN51IP
[22/01/2001 16:00|---hs----|11] - D:\WIN51IP.B2
[25/07/2001 21:47|---hs----|11] - D:\WIN51IP.RC2
[17/08/2001 14:17|---hs----|184] - D:\WINBOM.INI
[24/02/2004 17:38|--a------|498] - D:\BATCH.OLD
[01/02/2006 04:03|--ahs----|1552] - D:\BATCH.LOG
[02/01/2006 11:06|---hs----|208] - D:\cPCinfo.log
[16/04/2006 19:31|-r-hs----|26] - D:\RCBoot.sys
[17/07/2008 10:28|--a------|776256] - K:\ez5sys.bin
################## [ Vaccination ]
# C:\autorun.inf -> Folder created by UsbFix.
# D:\autorun.inf -> Folder created by UsbFix.
# K:\autorun.inf -> Folder created by UsbFix.
################## [ Cracks / Keygens / Serials ]
# -> Nothing found !
################## [ ! Fin du rapport # UsbFix V3.017 ! ]
http://www.gmer.net/
Le scan se fait à partir de l'onglet Rootkit puis en cliquant sur le bouton Scan en bas à droite.
Si gmer détecte un service rootkité, vous avez possibilité une fois le scan terminé en effectuant un clic droit Delete the service le dit service.
içi un tuto
https://www.malekal.com/tutorial-gmer/ très bien fait
Le scan se fait à partir de l'onglet Rootkit puis en cliquant sur le bouton Scan en bas à droite.
Si gmer détecte un service rootkité, vous avez possibilité une fois le scan terminé en effectuant un clic droit Delete the service le dit service.
içi un tuto
https://www.malekal.com/tutorial-gmer/ très bien fait
Coucou, désolé de ne pas avoir répondu avant mais j'étais assez occupé.
Tu veux que je poste un log de gmer?
Tu veux que je poste un log de gmer?
salut ; alors sa a donner quoi ?
oui
Par Manque De Curiosité On Risque De Mourir Ignorant;Tu es libre de penser que tu es C..,
Mais C.. de penser que tu es libre...Merci a australe13
oui
Par Manque De Curiosité On Risque De Mourir Ignorant;Tu es libre de penser que tu es C..,
Mais C.. de penser que tu es libre...Merci a australe13
Recoucou, voici les deux logs (un scan du disk C:/ et un du Disk D:/ ) :
Le premier :
GMER 1.0.15.14972 - http://www.gmer.net
Rootkit scan 2009-05-11 22:40:49
Windows 5.1.2600 Service Pack 3
---- System - GMER 1.0.15 ----
SSDT BA67BAFE ZwCreateKey
SSDT BA67BAF4 ZwCreateThread
SSDT BA67BB03 ZwDeleteKey
SSDT BA67BB0D ZwDeleteValueKey
SSDT sptd.sys ZwEnumerateKey [0xB9EDBD48]
SSDT sptd.sys ZwEnumerateValueKey [0xB9EDC0C0]
SSDT BA67BB12 ZwLoadKey
SSDT sptd.sys ZwOpenKey [0xB9EDBAE2]
SSDT BA67BAE0 ZwOpenProcess
SSDT BA67BAE5 ZwOpenThread
SSDT sptd.sys ZwQueryKey [0xB9EDC18A]
SSDT sptd.sys ZwQueryValueKey [0xB9EDC022]
SSDT BA67BB1C ZwReplaceKey
SSDT BA67BB17 ZwRestoreKey
SSDT BA67BB08 ZwSetValueKey
SSDT BA67BAEF ZwTerminateProcess
---- Kernel code sections - GMER 1.0.15 ----
? C:\WINDOWS\system32\drivers\sptd.sys Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
? C:\WINDOWS\System32\Drivers\SPTD2477.SYS Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
.text dtscsi.sys!A0DB34FC6FE35D429A28ADDE5467D4D7 B87D84D0 16 Bytes [02, D4, 21, A1, D8, 3D, 66, ...] {ADD DL, AH; AND [ECX-0x6e99c228], ESP; OR EAX, 0xe49536d5; IN EAX, 0x89; PUSH ESP}
.text dtscsi.sys!A0DB34FC6FE35D429A28ADDE5467D4D7 + 11 B87D84E1 31 Bytes [70, 7D, B8, 39, 65, 07, 5C, ...]
? C:\WINDOWS\System32\Drivers\dtscsi.sys Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
---- Kernel IAT/EAT - GMER 1.0.15 ----
IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [B9ED7A32] sptd.sys
IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [B9ED7B6E] sptd.sys
IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [B9ED7AF6] sptd.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [B9ED86CC] sptd.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [B9ED85A2] sptd.sys
IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [B9EFABBC] sptd.sys
---- Devices - GMER 1.0.15 ----
Device \FileSystem\Ntfs \Ntfs 8AAC2708
AttachedDevice \FileSystem\Ntfs \Ntfs bb-run.sys (Promise Disk Accelerator/Promise Technology, Inc.)
Device \FileSystem\Fastfat \FatCdrom 8A392340
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 arkbcfltr.sys (Microsoft AR PS/2 Keyboard Filter Driver (Beta 2 Release 2)/Microsoft Corporation)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 arkbcfltr.sys (Microsoft AR PS/2 Keyboard Filter Driver (Beta 2 Release 2)/Microsoft Corporation)
Device \Driver\dmio \Device\DmControl\DmIoDaemon 8AB0D378
Device \Driver\dmio \Device\DmControl\DmConfig 8AB0D378
Device \Driver\dmio \Device\DmControl\DmPnP 8AB0D378
Device \Driver\dmio \Device\DmControl\DmInfo 8AB0D378
Device \Driver\NetBT \Device\NetBT_Tcpip_{F20F78A5-E80C-42C3-9777-7E2A8DD6042A} 8A58B0E8
Device \Driver\usbstor \Device\00000070 8A386C88
Device \Driver\Ftdisk \Device\HarddiskVolume1 8AB0D630
Device \Driver\usbstor \Device\00000071 8A386C88
Device \Driver\Ftdisk \Device\HarddiskVolume2 8AB0D630
Device \Driver\Cdrom \Device\CdRom0 8A650388
Device \Driver\usbstor \Device\00000072 8A386C88
Device \FileSystem\Rdbss \Device\FsWrap 8A4244A8
Device \Driver\Cdrom \Device\CdRom1 8A650388
Device \Driver\Ftdisk \Device\HarddiskVolume3 8AB0D630
Device \Driver\Ftdisk \Device\HarddiskVolume4 8AB0D630
Device \Driver\NetBT \Device\NetBt_Wins_Export 8A58B0E8
Device \Driver\00000043 \Device\0000004a sptd.sys
Device \Driver\NetBT \Device\NetbiosSmb 8A58B0E8
Device \Driver\Disk \Device\Harddisk0\DR0 8AAC29C0
Device \Driver\Disk \Device\Harddisk1\DR5 8AAC29C0
Device \Driver\Disk \Device\Harddisk1\DP(1)0-0+9 8AAC29C0
Device \Driver\Disk \Device\Harddisk2\DP(1)0-0+a 8AAC29C0
Device \Driver\Disk \Device\Harddisk2\DR6 8AAC29C0
Device \Driver\Disk \Device\Harddisk3\DP(1)0-0+b 8AAC29C0
Device \Driver\Disk \Device\Harddisk3\DR7 8AAC29C0
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 8A3B6290
Device \Driver\Disk \Device\Harddisk4\DP(1)0-0+c 8AAC29C0
Device \Driver\Disk \Device\Harddisk4\DR8 8AAC29C0
Device \Driver\usbstor \Device\0000006e 8A386C88
Device \FileSystem\MRxSmb \Device\LanmanRedirector 8A3B6290
Device \Driver\usbstor \Device\0000006f 8A386C88
Device \FileSystem\Npfs \Device\NamedPipe 8A5DA5F0
Device \Driver\Ftdisk \Device\FtControl 8AB0D630
Device \FileSystem\Msfs \Device\Mailslot 8A603770
Device \Driver\dtscsi \Device\Scsi\dtscsi1Port4Path0Target0Lun0 8A545EB0
Device \Driver\dtscsi \Device\Scsi\dtscsi1 8A545EB0
Device \FileSystem\Fastfat \Fat 8A392340
AttachedDevice \FileSystem\Fastfat \Fat bb-run.sys (Promise Disk Accelerator/Promise Technology, Inc.)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
Device \FileSystem\Cdfs \Cdfs 8A9F9868
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s0 -1778269534
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 -89719900
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 -1306907941
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xE2 0xA0 0x9D 0xE8 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x0A 0x22 0xFF 0xCF ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xED 0xCA 0xFF 0x67 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xE2 0xA0 0x9D 0xE8 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x0A 0x22 0xFF 0xCF ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xA7 0x75 0x14 0x72 ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools\
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xE2 0xA0 0x9D 0xE8 ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x0A 0x22 0xFF 0xCF ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xED 0xCA 0xFF 0x67 ...
---- EOF - GMER 1.0.15 ----
Donc voici le premier c'est un peu en bazar avec les retours a la ligne mais bon j'ai copier le log original ;)
Le premier :
GMER 1.0.15.14972 - http://www.gmer.net
Rootkit scan 2009-05-11 22:40:49
Windows 5.1.2600 Service Pack 3
---- System - GMER 1.0.15 ----
SSDT BA67BAFE ZwCreateKey
SSDT BA67BAF4 ZwCreateThread
SSDT BA67BB03 ZwDeleteKey
SSDT BA67BB0D ZwDeleteValueKey
SSDT sptd.sys ZwEnumerateKey [0xB9EDBD48]
SSDT sptd.sys ZwEnumerateValueKey [0xB9EDC0C0]
SSDT BA67BB12 ZwLoadKey
SSDT sptd.sys ZwOpenKey [0xB9EDBAE2]
SSDT BA67BAE0 ZwOpenProcess
SSDT BA67BAE5 ZwOpenThread
SSDT sptd.sys ZwQueryKey [0xB9EDC18A]
SSDT sptd.sys ZwQueryValueKey [0xB9EDC022]
SSDT BA67BB1C ZwReplaceKey
SSDT BA67BB17 ZwRestoreKey
SSDT BA67BB08 ZwSetValueKey
SSDT BA67BAEF ZwTerminateProcess
---- Kernel code sections - GMER 1.0.15 ----
? C:\WINDOWS\system32\drivers\sptd.sys Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
? C:\WINDOWS\System32\Drivers\SPTD2477.SYS Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
.text dtscsi.sys!A0DB34FC6FE35D429A28ADDE5467D4D7 B87D84D0 16 Bytes [02, D4, 21, A1, D8, 3D, 66, ...] {ADD DL, AH; AND [ECX-0x6e99c228], ESP; OR EAX, 0xe49536d5; IN EAX, 0x89; PUSH ESP}
.text dtscsi.sys!A0DB34FC6FE35D429A28ADDE5467D4D7 + 11 B87D84E1 31 Bytes [70, 7D, B8, 39, 65, 07, 5C, ...]
? C:\WINDOWS\System32\Drivers\dtscsi.sys Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
---- Kernel IAT/EAT - GMER 1.0.15 ----
IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [B9ED7A32] sptd.sys
IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [B9ED7B6E] sptd.sys
IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [B9ED7AF6] sptd.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [B9ED86CC] sptd.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [B9ED85A2] sptd.sys
IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [B9EFABBC] sptd.sys
---- Devices - GMER 1.0.15 ----
Device \FileSystem\Ntfs \Ntfs 8AAC2708
AttachedDevice \FileSystem\Ntfs \Ntfs bb-run.sys (Promise Disk Accelerator/Promise Technology, Inc.)
Device \FileSystem\Fastfat \FatCdrom 8A392340
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 arkbcfltr.sys (Microsoft AR PS/2 Keyboard Filter Driver (Beta 2 Release 2)/Microsoft Corporation)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 arkbcfltr.sys (Microsoft AR PS/2 Keyboard Filter Driver (Beta 2 Release 2)/Microsoft Corporation)
Device \Driver\dmio \Device\DmControl\DmIoDaemon 8AB0D378
Device \Driver\dmio \Device\DmControl\DmConfig 8AB0D378
Device \Driver\dmio \Device\DmControl\DmPnP 8AB0D378
Device \Driver\dmio \Device\DmControl\DmInfo 8AB0D378
Device \Driver\NetBT \Device\NetBT_Tcpip_{F20F78A5-E80C-42C3-9777-7E2A8DD6042A} 8A58B0E8
Device \Driver\usbstor \Device\00000070 8A386C88
Device \Driver\Ftdisk \Device\HarddiskVolume1 8AB0D630
Device \Driver\usbstor \Device\00000071 8A386C88
Device \Driver\Ftdisk \Device\HarddiskVolume2 8AB0D630
Device \Driver\Cdrom \Device\CdRom0 8A650388
Device \Driver\usbstor \Device\00000072 8A386C88
Device \FileSystem\Rdbss \Device\FsWrap 8A4244A8
Device \Driver\Cdrom \Device\CdRom1 8A650388
Device \Driver\Ftdisk \Device\HarddiskVolume3 8AB0D630
Device \Driver\Ftdisk \Device\HarddiskVolume4 8AB0D630
Device \Driver\NetBT \Device\NetBt_Wins_Export 8A58B0E8
Device \Driver\00000043 \Device\0000004a sptd.sys
Device \Driver\NetBT \Device\NetbiosSmb 8A58B0E8
Device \Driver\Disk \Device\Harddisk0\DR0 8AAC29C0
Device \Driver\Disk \Device\Harddisk1\DR5 8AAC29C0
Device \Driver\Disk \Device\Harddisk1\DP(1)0-0+9 8AAC29C0
Device \Driver\Disk \Device\Harddisk2\DP(1)0-0+a 8AAC29C0
Device \Driver\Disk \Device\Harddisk2\DR6 8AAC29C0
Device \Driver\Disk \Device\Harddisk3\DP(1)0-0+b 8AAC29C0
Device \Driver\Disk \Device\Harddisk3\DR7 8AAC29C0
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 8A3B6290
Device \Driver\Disk \Device\Harddisk4\DP(1)0-0+c 8AAC29C0
Device \Driver\Disk \Device\Harddisk4\DR8 8AAC29C0
Device \Driver\usbstor \Device\0000006e 8A386C88
Device \FileSystem\MRxSmb \Device\LanmanRedirector 8A3B6290
Device \Driver\usbstor \Device\0000006f 8A386C88
Device \FileSystem\Npfs \Device\NamedPipe 8A5DA5F0
Device \Driver\Ftdisk \Device\FtControl 8AB0D630
Device \FileSystem\Msfs \Device\Mailslot 8A603770
Device \Driver\dtscsi \Device\Scsi\dtscsi1Port4Path0Target0Lun0 8A545EB0
Device \Driver\dtscsi \Device\Scsi\dtscsi1 8A545EB0
Device \FileSystem\Fastfat \Fat 8A392340
AttachedDevice \FileSystem\Fastfat \Fat bb-run.sys (Promise Disk Accelerator/Promise Technology, Inc.)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
Device \FileSystem\Cdfs \Cdfs 8A9F9868
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s0 -1778269534
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 -89719900
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 -1306907941
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xE2 0xA0 0x9D 0xE8 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x0A 0x22 0xFF 0xCF ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xED 0xCA 0xFF 0x67 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xE2 0xA0 0x9D 0xE8 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x0A 0x22 0xFF 0xCF ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xA7 0x75 0x14 0x72 ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools\
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xE2 0xA0 0x9D 0xE8 ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x0A 0x22 0xFF 0xCF ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xED 0xCA 0xFF 0x67 ...
---- EOF - GMER 1.0.15 ----
Donc voici le premier c'est un peu en bazar avec les retours a la ligne mais bon j'ai copier le log original ;)
Et voici le second :
GMER 1.0.15.14972 - http://www.gmer.net
Rootkit scan 2009-05-12 11:42:55
Windows 5.1.2600 Service Pack 3
---- System - GMER 1.0.15 ----
SSDT BA7EC95E ZwCreateKey
SSDT BA7EC954 ZwCreateThread
SSDT BA7EC963 ZwDeleteKey
SSDT BA7EC96D ZwDeleteValueKey
SSDT sptd.sys ZwEnumerateKey [0xB9EDBD48]
SSDT sptd.sys ZwEnumerateValueKey [0xB9EDC0C0]
SSDT BA7EC972 ZwLoadKey
SSDT sptd.sys ZwOpenKey [0xB9EDBAE2]
SSDT BA7EC940 ZwOpenProcess
SSDT BA7EC945 ZwOpenThread
SSDT sptd.sys ZwQueryKey [0xB9EDC18A]
SSDT sptd.sys ZwQueryValueKey [0xB9EDC022]
SSDT BA7EC97C ZwReplaceKey
SSDT BA7EC977 ZwRestoreKey
SSDT BA7EC968 ZwSetValueKey
SSDT BA7EC94F ZwTerminateProcess
---- Kernel code sections - GMER 1.0.15 ----
? C:\WINDOWS\system32\drivers\sptd.sys Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
? C:\WINDOWS\System32\Drivers\SPTD2477.SYS Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
.text dtscsi.sys!A0DB34FC6FE35D429A28ADDE5467D4D7 B87BE4D0 16 Bytes [61, C1, 39, B2, 99, 24, 33, ...]
.text dtscsi.sys!A0DB34FC6FE35D429A28ADDE5467D4D7 + 11 B87BE4E1 31 Bytes [D0, 7B, B8, 74, 5E, 1F, 0E, ...]
? C:\WINDOWS\System32\Drivers\dtscsi.sys Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
? C:\DOCUME~1\Odile\LOCALS~1\Temp\mc21.tmp Le fichier spécifié est introuvable. !
---- User code sections - GMER 1.0.15 ----
.text C:\Documents and Settings\Antoine\Bureau\rrbkcc9w.exe[1200] kernel32.dll!FreeLibrary + 15 7C80AC93 4 Bytes CALL 5F00003D
.text C:\HP\KBD\KBD.EXE[1688] kernel32.dll!FreeLibrary + 15 7C80AC93 4 Bytes CALL 5F00003D
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[2348] kernel32.dll!FreeLibrary + 15 7C80AC93 4 Bytes CALL 5F00003D
.text C:\WINDOWS\System32\svchost.exe[2408] kernel32.dll!FreeLibrary + 15 7C80AC93 4 Bytes CALL 5F00003D
.text C:\WINDOWS\ALCXMNTR.EXE[2500] kernel32.dll!FreeLibrary + 15 7C80AC93 4 Bytes CALL 5F00003D
.text ...
---- Kernel IAT/EAT - GMER 1.0.15 ----
IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [B9ED7A32] sptd.sys
IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [B9ED7B6E] sptd.sys
IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [B9ED7AF6] sptd.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [B9ED86CC] sptd.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [B9ED85A2] sptd.sys
IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [B9EFABBC] sptd.sys
---- Devices - GMER 1.0.15 ----
Device \FileSystem\Ntfs \Ntfs 8AAC2708
AttachedDevice \FileSystem\Ntfs \Ntfs bb-run.sys (Promise Disk Accelerator/Promise Technology, Inc.)
Device \FileSystem\Fastfat \FatCdrom 8A4360E8
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 arkbcfltr.sys (Microsoft AR PS/2 Keyboard Filter Driver (Beta 2 Release 2)/Microsoft Corporation)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 arkbcfltr.sys (Microsoft AR PS/2 Keyboard Filter Driver (Beta 2 Release 2)/Microsoft Corporation)
Device \Driver\dmio \Device\DmControl\DmIoDaemon 8AB0D378
Device \Driver\dmio \Device\DmControl\DmConfig 8AB0D378
Device \Driver\dmio \Device\DmControl\DmPnP 8AB0D378
Device \Driver\dmio \Device\DmControl\DmInfo 8AB0D378
Device \Driver\NetBT \Device\NetBT_Tcpip_{F20F78A5-E80C-42C3-9777-7E2A8DD6042A} 8A5F7240
Device \Driver\usbstor \Device\00000070 8A5DB1F8
Device \Driver\Ftdisk \Device\HarddiskVolume1 8AB0D630
Device \Driver\usbstor \Device\00000071 8A5DB1F8
Device \Driver\Ftdisk \Device\HarddiskVolume2 8AB0D630
Device \Driver\Cdrom \Device\CdRom0 8A6754E8
Device \Driver\usbstor \Device\00000072 8A5DB1F8
Device \FileSystem\Rdbss \Device\FsWrap 8A5690E8
Device \Driver\Cdrom \Device\CdRom1 8A6754E8
Device \Driver\Ftdisk \Device\HarddiskVolume3 8AB0D630
Device \Driver\Ftdisk \Device\HarddiskVolume4 8AB0D630
Device \Driver\NetBT \Device\NetBt_Wins_Export 8A5F7240
Device \Driver\00000043 \Device\0000004a sptd.sys
Device \Driver\NetBT \Device\NetbiosSmb 8A5F7240
Device \Driver\Disk \Device\Harddisk0\DR0 8AAC29C0
Device \Driver\Disk \Device\Harddisk1\DR5 8AAC29C0
Device \Driver\Disk \Device\Harddisk1\DP(1)0-0+9 8AAC29C0
Device \Driver\Disk \Device\Harddisk2\DP(1)0-0+a 8AAC29C0
Device \Driver\Disk \Device\Harddisk2\DR6 8AAC29C0
Device \Driver\Disk \Device\Harddisk3\DP(1)0-0+b 8AAC29C0
Device \Driver\Disk \Device\Harddisk3\DR7 8AAC29C0
Device \Driver\Disk \Device\Harddisk4\DP(1)0-0+c 8AAC29C0
Device \Driver\Disk \Device\Harddisk4\DR8 8AAC29C0
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 8A5B1848
Device \Driver\usbstor \Device\0000006e 8A5DB1F8
Device \FileSystem\MRxSmb \Device\LanmanRedirector 8A5B1848
Device \Driver\usbstor \Device\0000006f 8A5DB1F8
Device \FileSystem\Npfs \Device\NamedPipe 8A6310E8
Device \Driver\Ftdisk \Device\FtControl 8AB0D630
Device \FileSystem\Msfs \Device\Mailslot 8A611748
Device \Driver\dtscsi \Device\Scsi\dtscsi1Port4Path0Target0Lun0 8A555CD0
Device \Driver\dtscsi \Device\Scsi\dtscsi1 8A555CD0
Device \FileSystem\Fastfat \Fat 8A4360E8
AttachedDevice \FileSystem\Fastfat \Fat bb-run.sys (Promise Disk Accelerator/Promise Technology, Inc.)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
Device \FileSystem\Cdfs \Cdfs 8A50B300
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s0 -1778269534
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 -89719900
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 -1306907941
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xE2 0xA0 0x9D 0xE8 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x0A 0x22 0xFF 0xCF ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xED 0xCA 0xFF 0x67 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xE2 0xA0 0x9D 0xE8 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x0A 0x22 0xFF 0xCF ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xA7 0x75 0x14 0x72 ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools\
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xE2 0xA0 0x9D 0xE8 ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x0A 0x22 0xFF 0xCF ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xED 0xCA 0xFF 0x67 ...
---- EOF - GMER 1.0.15 ----
GMER 1.0.15.14972 - http://www.gmer.net
Rootkit scan 2009-05-12 11:42:55
Windows 5.1.2600 Service Pack 3
---- System - GMER 1.0.15 ----
SSDT BA7EC95E ZwCreateKey
SSDT BA7EC954 ZwCreateThread
SSDT BA7EC963 ZwDeleteKey
SSDT BA7EC96D ZwDeleteValueKey
SSDT sptd.sys ZwEnumerateKey [0xB9EDBD48]
SSDT sptd.sys ZwEnumerateValueKey [0xB9EDC0C0]
SSDT BA7EC972 ZwLoadKey
SSDT sptd.sys ZwOpenKey [0xB9EDBAE2]
SSDT BA7EC940 ZwOpenProcess
SSDT BA7EC945 ZwOpenThread
SSDT sptd.sys ZwQueryKey [0xB9EDC18A]
SSDT sptd.sys ZwQueryValueKey [0xB9EDC022]
SSDT BA7EC97C ZwReplaceKey
SSDT BA7EC977 ZwRestoreKey
SSDT BA7EC968 ZwSetValueKey
SSDT BA7EC94F ZwTerminateProcess
---- Kernel code sections - GMER 1.0.15 ----
? C:\WINDOWS\system32\drivers\sptd.sys Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
? C:\WINDOWS\System32\Drivers\SPTD2477.SYS Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
.text dtscsi.sys!A0DB34FC6FE35D429A28ADDE5467D4D7 B87BE4D0 16 Bytes [61, C1, 39, B2, 99, 24, 33, ...]
.text dtscsi.sys!A0DB34FC6FE35D429A28ADDE5467D4D7 + 11 B87BE4E1 31 Bytes [D0, 7B, B8, 74, 5E, 1F, 0E, ...]
? C:\WINDOWS\System32\Drivers\dtscsi.sys Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
? C:\DOCUME~1\Odile\LOCALS~1\Temp\mc21.tmp Le fichier spécifié est introuvable. !
---- User code sections - GMER 1.0.15 ----
.text C:\Documents and Settings\Antoine\Bureau\rrbkcc9w.exe[1200] kernel32.dll!FreeLibrary + 15 7C80AC93 4 Bytes CALL 5F00003D
.text C:\HP\KBD\KBD.EXE[1688] kernel32.dll!FreeLibrary + 15 7C80AC93 4 Bytes CALL 5F00003D
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[2348] kernel32.dll!FreeLibrary + 15 7C80AC93 4 Bytes CALL 5F00003D
.text C:\WINDOWS\System32\svchost.exe[2408] kernel32.dll!FreeLibrary + 15 7C80AC93 4 Bytes CALL 5F00003D
.text C:\WINDOWS\ALCXMNTR.EXE[2500] kernel32.dll!FreeLibrary + 15 7C80AC93 4 Bytes CALL 5F00003D
.text ...
---- Kernel IAT/EAT - GMER 1.0.15 ----
IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [B9ED7A32] sptd.sys
IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [B9ED7B6E] sptd.sys
IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [B9ED7AF6] sptd.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [B9ED86CC] sptd.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [B9ED85A2] sptd.sys
IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [B9EFABBC] sptd.sys
---- Devices - GMER 1.0.15 ----
Device \FileSystem\Ntfs \Ntfs 8AAC2708
AttachedDevice \FileSystem\Ntfs \Ntfs bb-run.sys (Promise Disk Accelerator/Promise Technology, Inc.)
Device \FileSystem\Fastfat \FatCdrom 8A4360E8
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 arkbcfltr.sys (Microsoft AR PS/2 Keyboard Filter Driver (Beta 2 Release 2)/Microsoft Corporation)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 arkbcfltr.sys (Microsoft AR PS/2 Keyboard Filter Driver (Beta 2 Release 2)/Microsoft Corporation)
Device \Driver\dmio \Device\DmControl\DmIoDaemon 8AB0D378
Device \Driver\dmio \Device\DmControl\DmConfig 8AB0D378
Device \Driver\dmio \Device\DmControl\DmPnP 8AB0D378
Device \Driver\dmio \Device\DmControl\DmInfo 8AB0D378
Device \Driver\NetBT \Device\NetBT_Tcpip_{F20F78A5-E80C-42C3-9777-7E2A8DD6042A} 8A5F7240
Device \Driver\usbstor \Device\00000070 8A5DB1F8
Device \Driver\Ftdisk \Device\HarddiskVolume1 8AB0D630
Device \Driver\usbstor \Device\00000071 8A5DB1F8
Device \Driver\Ftdisk \Device\HarddiskVolume2 8AB0D630
Device \Driver\Cdrom \Device\CdRom0 8A6754E8
Device \Driver\usbstor \Device\00000072 8A5DB1F8
Device \FileSystem\Rdbss \Device\FsWrap 8A5690E8
Device \Driver\Cdrom \Device\CdRom1 8A6754E8
Device \Driver\Ftdisk \Device\HarddiskVolume3 8AB0D630
Device \Driver\Ftdisk \Device\HarddiskVolume4 8AB0D630
Device \Driver\NetBT \Device\NetBt_Wins_Export 8A5F7240
Device \Driver\00000043 \Device\0000004a sptd.sys
Device \Driver\NetBT \Device\NetbiosSmb 8A5F7240
Device \Driver\Disk \Device\Harddisk0\DR0 8AAC29C0
Device \Driver\Disk \Device\Harddisk1\DR5 8AAC29C0
Device \Driver\Disk \Device\Harddisk1\DP(1)0-0+9 8AAC29C0
Device \Driver\Disk \Device\Harddisk2\DP(1)0-0+a 8AAC29C0
Device \Driver\Disk \Device\Harddisk2\DR6 8AAC29C0
Device \Driver\Disk \Device\Harddisk3\DP(1)0-0+b 8AAC29C0
Device \Driver\Disk \Device\Harddisk3\DR7 8AAC29C0
Device \Driver\Disk \Device\Harddisk4\DP(1)0-0+c 8AAC29C0
Device \Driver\Disk \Device\Harddisk4\DR8 8AAC29C0
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 8A5B1848
Device \Driver\usbstor \Device\0000006e 8A5DB1F8
Device \FileSystem\MRxSmb \Device\LanmanRedirector 8A5B1848
Device \Driver\usbstor \Device\0000006f 8A5DB1F8
Device \FileSystem\Npfs \Device\NamedPipe 8A6310E8
Device \Driver\Ftdisk \Device\FtControl 8AB0D630
Device \FileSystem\Msfs \Device\Mailslot 8A611748
Device \Driver\dtscsi \Device\Scsi\dtscsi1Port4Path0Target0Lun0 8A555CD0
Device \Driver\dtscsi \Device\Scsi\dtscsi1 8A555CD0
Device \FileSystem\Fastfat \Fat 8A4360E8
AttachedDevice \FileSystem\Fastfat \Fat bb-run.sys (Promise Disk Accelerator/Promise Technology, Inc.)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
Device \FileSystem\Cdfs \Cdfs 8A50B300
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s0 -1778269534
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 -89719900
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 -1306907941
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xE2 0xA0 0x9D 0xE8 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x0A 0x22 0xFF 0xCF ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xED 0xCA 0xFF 0x67 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xE2 0xA0 0x9D 0xE8 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x0A 0x22 0xFF 0xCF ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xA7 0x75 0x14 0x72 ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools\
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xE2 0xA0 0x9D 0xE8 ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x0A 0x22 0xFF 0xCF ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xED 0xCA 0xFF 0x67 ...
---- EOF - GMER 1.0.15 ----
Bon voilà c'est assez dur a lire je comprends, je tiens juste a dire que je n'ai eu aucune alerte de rootkits détecté durant les deux scans.
fait un scan en ligne ici
https://www.trendmicro.com/en_us/forHome/products/housecall.html
même s'il ne détecte pas d'infection il peut dévoiler des faille de sécurité
https://www.trendmicro.com/en_us/forHome/products/housecall.html
même s'il ne détecte pas d'infection il peut dévoiler des faille de sécurité
va a celui la
http://www.bitdefender.fr/scan_fr/scan8/ie.html
si l'autre ne marche pas c'est ta plate forme java pas a jour
http://www.bitdefender.fr/scan_fr/scan8/ie.html
si l'autre ne marche pas c'est ta plate forme java pas a jour
Re, bon je ne suis pas encore aller sur ton site par contre le guard d'antivir m'as dit que j'avais un trojan : HpHuni03.exe , qui est selon la recherche sur un site recensant les processus, un exe de hp photosmart.
Je l'ai mis en quarantaine et je ne sais pas quoi en faire, Antivir me dit que c'est le trojan Tr/Lena.B
Tiens un nouveau encore que le guard découvre, tjrs un Tr/Lena.B
...ET tiens c'est bizarre,je suis en train de faire un scan malware bytes et le guard les trouve quand malware bytes recherche dans la zone ou le guard trouve le soi disant virus...Tu me suis? :P
Je l'ai mis en quarantaine et je ne sais pas quoi en faire, Antivir me dit que c'est le trojan Tr/Lena.B
Tiens un nouveau encore que le guard découvre, tjrs un Tr/Lena.B
...ET tiens c'est bizarre,je suis en train de faire un scan malware bytes et le guard les trouve quand malware bytes recherche dans la zone ou le guard trouve le soi disant virus...Tu me suis? :P
C'est bizarre... le guard calque ses recherches sur le scan de malwarebytes...Je lance un scan antivir
Fait vérifier ces fichier sur virus total
Rends toi sur ce site :
https://www.virustotal.com/gui/
Clique sur parcourir et cherche ces fichiers par contre tu peut verifier les fichier que un par un:
HpHuni03.exe
Clique sur envoyer le fichier.
Un rapport va s'élaborer ligne à ligne.
Attends la fin. Il doit comprendre la taille du fichier envoyé.
Sauvegarde le rapport avec le bloc-note.
Copie le dans ta réponse.
par moment il y'a déjà un rapport de prêt toi tu fera réanalyser le fichier maintenant
ouvre antivir et va sur rapport poste le dernier rapport
pour malwarbyte c'est normal il fait un très bon complément de antivir se qu'il peut pas virer il fait appel a antivir
Par Manque De Curiosité On Risque De Mourir Ignorant;Tu es libre de penser que tu es C..,
Mais C.. de penser que tu es libre...Merci a australe13
Rends toi sur ce site :
https://www.virustotal.com/gui/
Clique sur parcourir et cherche ces fichiers par contre tu peut verifier les fichier que un par un:
HpHuni03.exe
Clique sur envoyer le fichier.
Un rapport va s'élaborer ligne à ligne.
Attends la fin. Il doit comprendre la taille du fichier envoyé.
Sauvegarde le rapport avec le bloc-note.
Copie le dans ta réponse.
par moment il y'a déjà un rapport de prêt toi tu fera réanalyser le fichier maintenant
ouvre antivir et va sur rapport poste le dernier rapport
pour malwarbyte c'est normal il fait un très bon complément de antivir se qu'il peut pas virer il fait appel a antivir
Par Manque De Curiosité On Risque De Mourir Ignorant;Tu es libre de penser que tu es C..,
Mais C.. de penser que tu es libre...Merci a australe13
Et voici le rapport antivir :
Avira AntiVir Personal
Report file date: mercredi 13 mai 2009 18:17
Scanning for 1390366 virus strains and unwanted programs.
Licensee : Avira AntiVir Personal - FREE Antivirus
Serial number : 0000149996-ADJIE-0000001
Platform : Windows XP
Windows version : (Service Pack 3) [5.1.2600]
Boot mode : Normally booted
Username : Antoine
Computer name : ODI_ANTOINE
Version information:
BUILD.DAT : 9.0.0.394 17962 Bytes 17/04/2009 11:20:00
AVSCAN.EXE : 9.0.3.5 466689 Bytes 28/04/2009 16:58:52
AVSCAN.DLL : 9.0.3.0 40705 Bytes 27/02/2009 08:58:24
LUKE.DLL : 9.0.3.2 209665 Bytes 20/02/2009 09:35:49
LUKERES.DLL : 9.0.2.0 12033 Bytes 27/02/2009 08:58:52
ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 10:30:36
ANTIVIR1.VDF : 7.1.2.12 3336192 Bytes 11/02/2009 18:33:26
ANTIVIR2.VDF : 7.1.3.185 2010112 Bytes 12/05/2009 19:10:32
ANTIVIR3.VDF : 7.1.3.192 36864 Bytes 12/05/2009 19:10:33
Engineversion : 8.2.0.166
AEVDF.DLL : 8.1.1.1 106868 Bytes 30/04/2009 18:02:10
AESCRIPT.DLL : 8.1.1.81 385401 Bytes 08/05/2009 18:02:19
AESCN.DLL : 8.1.1.10 127348 Bytes 28/04/2009 16:58:52
AERDL.DLL : 8.1.1.3 438645 Bytes 29/10/2008 16:24:41
AEPACK.DLL : 8.1.3.16 397686 Bytes 08/05/2009 18:02:17
AEOFFICE.DLL : 8.1.0.36 196987 Bytes 26/02/2009 18:01:56
AEHEUR.DLL : 8.1.0.128 1757559 Bytes 08/05/2009 18:02:15
AEHELP.DLL : 8.1.2.2 119158 Bytes 26/02/2009 18:01:56
AEGEN.DLL : 8.1.1.42 348531 Bytes 08/05/2009 18:02:07
AEEMU.DLL : 8.1.0.9 393588 Bytes 09/10/2008 12:32:40
AECORE.DLL : 8.1.6.9 176500 Bytes 28/04/2009 16:58:51
AEBB.DLL : 8.1.0.3 53618 Bytes 09/10/2008 12:32:40
AVWINLL.DLL : 9.0.0.3 18177 Bytes 12/12/2008 06:47:59
AVPREF.DLL : 9.0.0.1 43777 Bytes 05/12/2008 08:32:15
AVREP.DLL : 8.0.0.3 155905 Bytes 20/01/2009 12:34:28
AVREG.DLL : 9.0.0.0 36609 Bytes 05/12/2008 08:32:09
AVARKT.DLL : 9.0.0.3 292609 Bytes 28/04/2009 16:58:52
AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 30/01/2009 08:37:08
SQLITE3.DLL : 3.6.1.0 326401 Bytes 28/01/2009 13:03:49
SMTPLIB.DLL : 9.2.0.25 28417 Bytes 02/02/2009 06:21:33
NETNT.DLL : 9.0.0.0 11521 Bytes 05/12/2008 08:32:10
RCIMAGE.DLL : 9.0.0.21 2438401 Bytes 09/02/2009 09:45:45
RCTEXT.DLL : 9.0.37.0 86785 Bytes 28/04/2009 16:58:51
Configuration settings for the scan:
Jobname.............................: Manual Selection
Configuration file..................: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\PROFILES\folder.avp
Logging.............................: low
Primary action......................: interactive
Secondary action....................: ignore
Scan master boot sector.............: on
Scan boot sector....................: on
Boot sectors........................: C:, D:,
Process scan........................: on
Scan registry.......................: on
Search for rootkits.................: on
Integrity checking of system files..: off
Scan all files......................: Intelligent file selection
Scan archives.......................: on
Recursion depth.....................: 20
Smart extensions....................: on
Macro heuristic.....................: on
File heuristic......................: medium
Deviating risk categories...........: +SPR,
Start of the scan: mercredi 13 mai 2009 18:17
Starting search for hidden objects.
'53223' objects were checked, '0' hidden objects were found.
The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'mbam.exe' - '1' Module(s) have been scanned
Scan process 'taskmgr.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'ALCXMNTR.EXE' - '1' Module(s) have been scanned
Scan process 'kbd.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'mcrdsvc.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
30 processes with 30 modules were scanned
Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Master boot sector HD1
[INFO] No virus was found!
Master boot sector HD2
[INFO] No virus was found!
Master boot sector HD3
[INFO] No virus was found!
Master boot sector HD4
[INFO] No virus was found!
Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'D:\'
[INFO] No virus was found!
Starting to scan executable files (registry).
The registry was scanned ( '68' files ).
Starting the file scan:
Begin scan in 'C:\' <HP_PAVILION>
C:\hiberfil.sys
[WARNING] The file could not be opened!
[NOTE] This file is a Windows system file.
[NOTE] This file cannot be opened for scanning.
C:\pagefile.sys
[WARNING] The file could not be opened!
[NOTE] This file is a Windows system file.
[NOTE] This file cannot be opened for scanning.
C:\WINDOWS\system32\drivers\dtscsi.sys
[WARNING] The file could not be opened!
C:\WINDOWS\system32\drivers\sptd.sys
[WARNING] The file could not be opened!
C:\WINDOWS\system32\drivers\sptd2477.sys
[WARNING] The file could not be opened!
Begin scan in 'D:\' <HP_RECOVERY>
End of the scan: mercredi 13 mai 2009 19:14
Used time: 56:28 Minute(s)
The scan has been done completely.
8607 Scanned directories
644389 Files were scanned
0 Viruses and/or unwanted programs were found
0 Files were classified as suspicious
0 files were deleted
0 Viruses and unwanted programs were repaired
0 Files were moved to quarantine
0 Files were renamed
5 Files cannot be scanned
644384 Files not concerned
16414 Archives were scanned
5 Warnings
2 Notes
53223 Objects were scanned with rootkit scan
0 Hidden objects were found
Avira AntiVir Personal
Report file date: mercredi 13 mai 2009 18:17
Scanning for 1390366 virus strains and unwanted programs.
Licensee : Avira AntiVir Personal - FREE Antivirus
Serial number : 0000149996-ADJIE-0000001
Platform : Windows XP
Windows version : (Service Pack 3) [5.1.2600]
Boot mode : Normally booted
Username : Antoine
Computer name : ODI_ANTOINE
Version information:
BUILD.DAT : 9.0.0.394 17962 Bytes 17/04/2009 11:20:00
AVSCAN.EXE : 9.0.3.5 466689 Bytes 28/04/2009 16:58:52
AVSCAN.DLL : 9.0.3.0 40705 Bytes 27/02/2009 08:58:24
LUKE.DLL : 9.0.3.2 209665 Bytes 20/02/2009 09:35:49
LUKERES.DLL : 9.0.2.0 12033 Bytes 27/02/2009 08:58:52
ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 10:30:36
ANTIVIR1.VDF : 7.1.2.12 3336192 Bytes 11/02/2009 18:33:26
ANTIVIR2.VDF : 7.1.3.185 2010112 Bytes 12/05/2009 19:10:32
ANTIVIR3.VDF : 7.1.3.192 36864 Bytes 12/05/2009 19:10:33
Engineversion : 8.2.0.166
AEVDF.DLL : 8.1.1.1 106868 Bytes 30/04/2009 18:02:10
AESCRIPT.DLL : 8.1.1.81 385401 Bytes 08/05/2009 18:02:19
AESCN.DLL : 8.1.1.10 127348 Bytes 28/04/2009 16:58:52
AERDL.DLL : 8.1.1.3 438645 Bytes 29/10/2008 16:24:41
AEPACK.DLL : 8.1.3.16 397686 Bytes 08/05/2009 18:02:17
AEOFFICE.DLL : 8.1.0.36 196987 Bytes 26/02/2009 18:01:56
AEHEUR.DLL : 8.1.0.128 1757559 Bytes 08/05/2009 18:02:15
AEHELP.DLL : 8.1.2.2 119158 Bytes 26/02/2009 18:01:56
AEGEN.DLL : 8.1.1.42 348531 Bytes 08/05/2009 18:02:07
AEEMU.DLL : 8.1.0.9 393588 Bytes 09/10/2008 12:32:40
AECORE.DLL : 8.1.6.9 176500 Bytes 28/04/2009 16:58:51
AEBB.DLL : 8.1.0.3 53618 Bytes 09/10/2008 12:32:40
AVWINLL.DLL : 9.0.0.3 18177 Bytes 12/12/2008 06:47:59
AVPREF.DLL : 9.0.0.1 43777 Bytes 05/12/2008 08:32:15
AVREP.DLL : 8.0.0.3 155905 Bytes 20/01/2009 12:34:28
AVREG.DLL : 9.0.0.0 36609 Bytes 05/12/2008 08:32:09
AVARKT.DLL : 9.0.0.3 292609 Bytes 28/04/2009 16:58:52
AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 30/01/2009 08:37:08
SQLITE3.DLL : 3.6.1.0 326401 Bytes 28/01/2009 13:03:49
SMTPLIB.DLL : 9.2.0.25 28417 Bytes 02/02/2009 06:21:33
NETNT.DLL : 9.0.0.0 11521 Bytes 05/12/2008 08:32:10
RCIMAGE.DLL : 9.0.0.21 2438401 Bytes 09/02/2009 09:45:45
RCTEXT.DLL : 9.0.37.0 86785 Bytes 28/04/2009 16:58:51
Configuration settings for the scan:
Jobname.............................: Manual Selection
Configuration file..................: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\PROFILES\folder.avp
Logging.............................: low
Primary action......................: interactive
Secondary action....................: ignore
Scan master boot sector.............: on
Scan boot sector....................: on
Boot sectors........................: C:, D:,
Process scan........................: on
Scan registry.......................: on
Search for rootkits.................: on
Integrity checking of system files..: off
Scan all files......................: Intelligent file selection
Scan archives.......................: on
Recursion depth.....................: 20
Smart extensions....................: on
Macro heuristic.....................: on
File heuristic......................: medium
Deviating risk categories...........: +SPR,
Start of the scan: mercredi 13 mai 2009 18:17
Starting search for hidden objects.
'53223' objects were checked, '0' hidden objects were found.
The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'mbam.exe' - '1' Module(s) have been scanned
Scan process 'taskmgr.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'ALCXMNTR.EXE' - '1' Module(s) have been scanned
Scan process 'kbd.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'mcrdsvc.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
30 processes with 30 modules were scanned
Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Master boot sector HD1
[INFO] No virus was found!
Master boot sector HD2
[INFO] No virus was found!
Master boot sector HD3
[INFO] No virus was found!
Master boot sector HD4
[INFO] No virus was found!
Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'D:\'
[INFO] No virus was found!
Starting to scan executable files (registry).
The registry was scanned ( '68' files ).
Starting the file scan:
Begin scan in 'C:\' <HP_PAVILION>
C:\hiberfil.sys
[WARNING] The file could not be opened!
[NOTE] This file is a Windows system file.
[NOTE] This file cannot be opened for scanning.
C:\pagefile.sys
[WARNING] The file could not be opened!
[NOTE] This file is a Windows system file.
[NOTE] This file cannot be opened for scanning.
C:\WINDOWS\system32\drivers\dtscsi.sys
[WARNING] The file could not be opened!
C:\WINDOWS\system32\drivers\sptd.sys
[WARNING] The file could not be opened!
C:\WINDOWS\system32\drivers\sptd2477.sys
[WARNING] The file could not be opened!
Begin scan in 'D:\' <HP_RECOVERY>
End of the scan: mercredi 13 mai 2009 19:14
Used time: 56:28 Minute(s)
The scan has been done completely.
8607 Scanned directories
644389 Files were scanned
0 Viruses and/or unwanted programs were found
0 Files were classified as suspicious
0 files were deleted
0 Viruses and unwanted programs were repaired
0 Files were moved to quarantine
0 Files were renamed
5 Files cannot be scanned
644384 Files not concerned
16414 Archives were scanned
5 Warnings
2 Notes
53223 Objects were scanned with rootkit scan
0 Hidden objects were found
